Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

There is no fixed version for commons-lang:commons-lang.

References

• Apache Pony Mail
• GitHub Commit

Overview

com.google.guava:guava is a set of core libraries that includes new collection types (such as multimap and multiset,immutable collections, a graph library, functional types, an in-memory cache and more.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the readObject deserialization paths in CompactHashMap, CompactHashSet, and MapMakerInternalMap. An attacker can crash a Java process with an OutOfMemoryError by supplying a crafted serialized stream that declares an oversized element count or initial capacity. During deserialization, CompactHashMap and CompactHashSet use the attacker-controlled size to initialize their backing storage, and MapMakerInternalMap propagates the attacker-controlled size into segment table allocation, letting a tiny payload force a much larger heap allocation.

Remediation

Upgrade com.google.guava:guava to version 33.7.2-jre or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub Issue
• GitHub Issue
• Maintainer's Advisory

Overview

org.apache.velocity:velocity is a general purpose template engine.

Affected versions of this package are vulnerable to Arbitrary Code Execution. An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine.

Note Users of org.apache.velocity:velocity should update to org.apache.velocity:velocity-engine-core version 2.3 to mitigate this vulnerability.

Remediation

There is no fixed version for org.apache.velocity:velocity.

References

• Apache Security Advisory

• GitHub PR

• GitHub Security Labs